Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iViewed your API keys

wale.id.au

Post reply on HN
Print view View original

51–60 of 116 posts

Re: iViewed your API keys

#51

Post by dylan604 »

OJFord wrote: post #11
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

I booked a hotel stay (in Canada, not Australia) and got an error page at some point that dumped out all env vars including database credentials. Tried my best to report (not publicly disclose) it, including asking the front desk for contact information for IT; no response. I think we're (on HN) often in quite a bubble of being (or striving to be) hot on this sort of thing, or frankly far trickier to exploit sorts of…

My favorite is just having the console open while visiting the web. It is amazing the amount of information devs "forget" to remove from sending to the console in production. A lot of console vomit is from JS frameworks. I don't know if there's a switch that can tell them to shut up in production or not, but it's one thing I look out for on anything I work on.

Re: iViewed your API keys

#52

Post by dylan604 »

mardifoufs wrote: post #48
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

But why is the Australian government so "police state" minded? Is that really what the Australian people want? I'd guess they just don't care either way, but in that case why would the Australian politicians push for that? Canada has a pretty similar apathy towards politics but even then we don't see the government forcing Canadian citizens to implement backdoors or raiding the offices of a broadcaster. (Yes the rece…

Seeing as Australia was used as a prison colony, I'd have thought they'd be much more likely to be against a strong ruling class.

Re: iViewed your API keys

#53

Post by jacobsenscott »

Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

Also in the US, where you can be sentenced to 41 months in prison for browsing a public URL at AT&T, and where the the Governor of Missouri wants to make it illegal to view the html source of a web page (because some state web site leaked all the SSNs of their teachers in some hidden html or something).

If I found something like this on a site I don't think I would notify anyone. Too risky. Maybe over TOR if they have a contact page or something. But it is hard to be anonymous these days.

Re: iViewed your API keys

#54

Post by gcommer »

zach_garwood wrote: post #31
speedgoose wrote: post #14

Earlier quoted context omitted.

Not really?

Kinda really. This entire class of security lapse can be avoided by not building a js app on the client.

Plenty of server-rendered apps have been caught putting private data in responses. In this very same comment section people have mentioned the story of a state website that included teacher SSN's in hidden fields[1], and OJFord shared a story of a server that included a full env var dump in error messages[2].

This sort of thing happens all the time to all sorts of services. Rather than just blaming JS, it's far more productive to think of technical controls that could catch this. For example Taint Checking[3] or scanning server responses for API keys.

[1]: https://news.ycombinator.com/item?id=31026374

[2]: https://news.ycombinator.com/item?id=31026415

[3]: https://en.wikipedia.org/wiki/Taint_checking

Re: iViewed your API keys

#55

Post by SomeCallMeTim »

ushakov wrote: post #35
_fat_santa wrote: post #33

Earlier quoted context omitted.

According to the article, they were keeping their environment variables in React's local state. To anyone that works with React professionally, or even on the side, this is so baffling that a team would do this. I'm honestly wondering who they hired for the job. Because this is one of the most fundamental failings in security I've ever seen.

> I'm honestly wondering who they hired for the job let me guess: bootcamp graduates? whoever was the cheapest?

Or outsourced to the lowest bidder.

Re: iViewed your API keys

#56

Post by jandrese »

mardifoufs wrote: post #48
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

But why is the Australian government so "police state" minded? Is that really what the Australian people want? I'd guess they just don't care either way, but in that case why would the Australian politicians push for that? Canada has a pretty similar apathy towards politics but even then we don't see the government forcing Canadian citizens to implement backdoors or raiding the offices of a broadcaster. (Yes the rece…

Propaganda works, Rupert Murdoch has known it for decades. Keep the people scared and they won't question what you are doing.

Re: iViewed your API keys

#57

Post by throwaheyy »

mardifoufs wrote: post #48
Grimburger wrote: post #3

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especially regarding a government entity. It's not that you've done anything in the slightest bit wrong. It's that others with power can easily make it become wrong with little to no backlash in the current Australian climate. I understand the desire for recognition,…

But why is the Australian government so "police state" minded? Is that really what the Australian people want? I'd guess they just don't care either way, but in that case why would the Australian politicians push for that? Canada has a pretty similar apathy towards politics but even then we don't see the government forcing Canadian citizens to implement backdoors or raiding the offices of a broadcaster. (Yes the rece…

In simple terms, Australia is a relatively young country that formed its own government in 1901. It was also isolated from the rest of the world and has a harsh environment with a lot of things that can kill you. This produced an overall culture of helping each other when you can (what gets called “mateship”), and trust in the government to help when it is needed. Australians generally like an orderly society, that translates to a publically-approved police state.

Re: iViewed your API keys

#58

Post by SomeCallMeTim »

raxxorraxor wrote: post #49
alias_neo wrote: post #10

Earlier quoted context omitted.

The step they seem to be missing is _the entire development process_. If you're using API keys to access stuff, you do it on your backend, there's no excuse for that stuff to make it to the frontend. If your "client" needs access to sensitive API keys, you need to rethink your architecture. As a (senior) backend software engineer, this reeks of a person/team who doesn't know how to architect and/or implement web appl…

Yeah, it shouldn't reach the client in any case. But providing secrets to applications isn't really a well solved problem in my opinion. Even if it is just an environment variable for the server process it could get exposed. If a clients needs an API key I would think to route the requests through the server and add the key information at that point, but I am not a web developer and not sure if that always scales for…

It's simply software engineering malpractice to have ever sent any of those keys to the client.

There is no excuse.

It is a well-solved problem to handle secrets; there are better and worse solutions. An environment variable for a server can get exposed if the server is hacked; a secret sent to a client is exposed the second the server goes live. One of these is much worse than the other.

There are also better solutions than environment variables. A competent team would be aware of many options. Whoever coded this is not competent, full stop. It's not that they didn't finish; these services should never have accessed from the client at all.

Post reply on HN